Lokiql: How to combine logs from different labels in one request?

[skl256]

Good day everyone! It doesn’t seem like a difficult question, but I couldn’t find an answer in the documentation or on Google.
I have 2 nginx that write logs to loki.
1-nginx: {job=“containers”, compose_service=“proxy”}
2-nginx: {job=“containers”, service_name="nginx_proxy}

I want to work with these logs as one whole, because… these are just two different nodes, and build one graph based on these logs, on one panel.

But in the first case we have the label name “compose_service” and in the second case “service_name” (it’s the name, not the value, in the case of different values, it’s clear that you can use ~=“value1|value2”).

Please help, thanks in advance.

[tonyswumac]

I’d advise you to align the labels and save yourself some headaches, something like this:

{job=“containers”, service_name="compose", compose_service=“proxy”}
{job=“containers”, service_name="nginx_proxy}

If you really can’t or don’t want to do that, you can use label_format to inject an arbiturary label at query time, like this:

{job="containers"} | label_format service_name="{{ .service_name | default .compose_service }}"

LogQL Analyzer | Grafana Loki documentation

[skl256]

Thank you very much! Yes, it looks like it’s easier to add a custom label to the service than to use label_format. Because When using label_format, it is clear that the search in logs will not be optimized.